diff --git a/scripts/check_test_wiring.py b/scripts/check_test_wiring.py
index 69d95f9b2..af0dc9d8f 100755
--- a/scripts/check_test_wiring.py
+++ b/scripts/check_test_wiring.py
@@ -320,7 +320,14 @@ def check_scheduled_alerts(root: Path) -> list[str]:
         "github.event.workflow_run.event == 'schedule'",
         "github.event.workflow_run.conclusion != 'success'",
         "github.event.workflow_run.conclusion != 'failure'",
+        "actions: read",
+        "issues: write",
+        "uses: ./.github/actions/schedule-failure-issue",
+        "github-token: ${{ secrets.GITHUB_TOKEN }}",
         "workflow-name: ${{ github.event.workflow_run.name }}",
+        "source-event: ${{ github.event.workflow_run.event }}",
+        "source-ref-name: ${{ github.event.workflow_run.head_branch }}",
+        "source-sha: ${{ github.event.workflow_run.head_sha }}",
         "source-run-id: ${{ github.event.workflow_run.id }}",
         "source-run-attempt: ${{ github.event.workflow_run.run_attempt }}",
     )
@@ -516,15 +523,23 @@ class SelfTests(unittest.TestCase):
                 names.append(path.stem)
                 path.write_text(f'name: "{path.stem}"\n{alert}')
             watchdog = root / ".github/workflows/scheduled-validation-watchdog.yml"
-            watchdog.write_text(
+            watchdog_source = (
                 "\n".join(f'- "{name}"' for name in names)
                 + "\ngithub.event.workflow_run.event == 'schedule'\n"
                 + "github.event.workflow_run.conclusion != 'success'\n"
                 + "github.event.workflow_run.conclusion != 'failure'\n"
+                + "actions: read\n"
+                + "issues: write\n"
+                + "uses: ./.github/actions/schedule-failure-issue\n"
+                + "github-token: ${{ secrets.GITHUB_TOKEN }}\n"
                 + "workflow-name: ${{ github.event.workflow_run.name }}\n"
+                + "source-event: ${{ github.event.workflow_run.event }}\n"
+                + "source-ref-name: ${{ github.event.workflow_run.head_branch }}\n"
+                + "source-sha: ${{ github.event.workflow_run.head_sha }}\n"
                 + "source-run-id: ${{ github.event.workflow_run.id }}\n"
                 + "source-run-attempt: ${{ github.event.workflow_run.run_attempt }}\n"
             )
+            watchdog.write_text(watchdog_source)
             self.assertEqual(check_scheduled_alerts(root), [])
 
             first = root / SCHEDULED_ALERT_WORKFLOWS[0]
@@ -540,9 +555,22 @@ class SelfTests(unittest.TestCase):
                 self.assertEqual(len(check_scheduled_alerts(root)), 1)
                 first.write_text(original)
 
-            watchdog.write_text(watchdog.read_text().replace(f'- "{names[0]}"\n', ""))
+            watchdog.write_text(watchdog_source.replace(f'- "{names[0]}"\n', ""))
             self.assertEqual(len(check_scheduled_alerts(root)), 1)
 
+            watchdog_mutations = (
+                ("actions: read", "actions: none"),
+                ("issues: write", "issues: read"),
+                ("uses: ./.github/actions/schedule-failure-issue", "uses: actions/checkout@v7"),
+                ("github-token: ${{ secrets.GITHUB_TOKEN }}", "github-token: missing"),
+                ("source-event: ${{ github.event.workflow_run.event }}", "source-event: wrong"),
+                ("source-ref-name: ${{ github.event.workflow_run.head_branch }}", "source-ref-name: wrong"),
+                ("source-sha: ${{ github.event.workflow_run.head_sha }}", "source-sha: wrong"),
+            )
+            for required, replacement in watchdog_mutations:
+                watchdog.write_text(watchdog_source.replace(required, replacement))
+                self.assertEqual(len(check_scheduled_alerts(root)), 1)
+
 def main() -> int:
     if sys.argv[1:] == ["--self-test"]:
         suite = unittest.defaultTestLoader.loadTestsFromTestCase(SelfTests)